OSCAR - Automate software analysis, compliance and security
summary
An Eclipse-hosted project combines existing OSS SCA pieces — fossology, ORT, SW360, ClearlyDefined, ScanCode — into a pluggable platform that lets teams compose their own inventory, license and vulnerability pipelines. It targets developer workflows by integrating SCA early and automating scans, license checks, catalogs and KPI reporting into CI systems. Design goals include continuous integration-style automation, multi-language support, distributed deployment and high-scale architectures, with a first major release planned within months.
AI-written summary · about
chapters (9)
- 0:00OSCAR project intro
- 3:49Motivation for open source tools
- 12:25Vendor lock-in risks
- 15:07Compliance tools for devs
- 17:31Open source security needs
- 20:35Working group efforts
- 25:39Industry support & tools
- 29:39Tool integration interfaces
- 33:58Summary & future outlook
related talks
30mFast, Lean, Precise, Controlled: Compliance Automation With OSCAL in Our Open-S...
33mORT Automate compliance using Open Source & InnerSource
40mAutomating Security and Compliance via a new standard-of-standards
38mOpen Source Licensing in the Era of AI-Assisted Coding
13mSecuring the Software Commons: Standards, Automation, and AI for a Resilie...
41mManaging the risk and growth of using Open Source Software
44mSecurity Research with Open Source Software: Vol. Omega
27mSecuring the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...